§ 01
Definition
Every member state has at least one; Germany has a federal commissioner plus state authorities. Estonia's is the Andmekaitse Inspektsioon (Data Protection Inspectorate). The authorities cooperate through the European Data Protection Board (EDPB).
§ 02
How it works
DPAs investigate complaints, audit organisations and issue fines. For companies operating across borders, the authority in the country of their main EU establishment usually takes the lead under the GDPR's 'one-stop-shop' system.
§ 03
Why it matters
If a VPN provider or website misuses your data, the DPA is where you can complain, free of charge. A provider's lead authority is a useful fact when judging its jurisdiction: it tells you which regulator actually supervises it.